CVE-2026-87424

Executive Summary

CVE-2026-87424 is an authentication bypass in the SupportLink API authentication component of Brocade ASCG (Applications/Support Case Gateway class of product) affecting all deployments prior to version 3.5.0. The root cause is the use of a hard coded cryptographic key (CWE-321), which allows an attacker to forge or reproduce authentication material and bypass authentication checks across affected deployments. Because the flaw is remotely reachable over the network, requires no privileges or user interaction, and yields a complete loss of confidentiality, integrity, and availability, it represents a high-severity risk for any organization exposing the SupportLink API. No public proof-of-concept, Nuclei template, or exploit code is currently tracked, and CISA KEV does not list this CVE; EPSS is low (0.00172, ~6.1st percentile), suggesting exploitation is not yet observed at scale.

Technical Analysis

The vulnerability resides in the SupportLink API authentication component of Brocade ASCG. Per the NVD description, the mechanism is the use of a hard coded cryptographic key — a violation of CWE-321 ("Use of Hard-coded Cryptographic Key"). In this class of flaw, a secret key that should be uniquely generated per deployment (or, at minimum, be configurable and protected) is instead embedded as a static value in the product's code or configuration. Because the key is identical across every vulnerable deployment — not merely per-installation — any party who recovers or guesses the key gains the ability to reproduce whatever cryptographic operation the authentication component relies on.

The attack surface is the SupportLink API authentication component, which is network-reachable (AV:N) and can be triggered without authentication (PR:N) and without user interaction (UI:N). The "across deployments" wording in the description is significant: it implies the key is not per-instance, so a single disclosure of the key compromises the authentication model of the entire install base, not just one customer. The cryptographic key is likely used to sign, encrypt, or verify tokens/credentials presented to the SupportLink API; a static key means an attacker who obtains it (or who can derive it from shipped artifacts) can mint valid authentication material or forge integrity-protected values.

Note that the exact key value, the algorithm (e.g., HMAC, symmetric cipher, signing scheme), and the specific API parameters are not disclosed in the available intelligence. No CVE description detail, vendor advisory text, or researcher write-up provides function names, endpoints, or key material. As a result, this analysis describes the vulnerability class and mechanism at the level supported by the source data and does not infer specific implementation details.

The CVSS vector used above (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) is a class-level estimate consistent with an unauthenticated network authentication bypass with full CIA impact. The source data provided no official CVSS score or vector (N/A), so the vector here is a reasoned estimate and is clearly labeled as such; it must not be treated as a vendor-published metric.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (CWE-321 authentication bypass) and the NVD statement that the flaw affects the SupportLink API authentication component "across deployments." No function names, endpoints, or parameters beyond those in the source text are asserted.

1. Reconnaissance / target identification. An attacker enumerates internet-exposed Brocade ASCG instances — for example via Shodan using http.title:"SupportLink" or http.html:"SupportLink" — and identifies hosts running versions prior to 3.5.0. Because the key is shared across deployments, the attacker only needs to identify any vulnerable target class, not a specific victim-specific secret.

2. Triggering the flaw class. The attacker targets the SupportLink API authentication component. In a CWE-321 authentication bypass, the flaw is triggered by presenting authentication material that is valid under the hard coded key. Since the key is static and known (recovered from the product or a single compromised instance), the attacker can generate credentials/tokens/signatures that the authentication component will accept — bypassing the normal authentication check rather than brute-forcing it.

3. Payload/execution method (vulnerability-class level). The attacker submits requests to the SupportLink API carrying forged authentication material computed with the static key. No specific endpoint path, header name, or parameter name can be stated because none is provided in the source data. At the class level, success is achieved when the API treats the forged material as authentic and authorizes the request.

4. Post-exploitation impact. Successful bypass grants the attacker the privileges and capabilities exposed by the SupportLink API, with full impact to confidentiality (C:H), integrity (I:H), and availability (A:H) in the estimated vector. Given the "across deployments" scope, a single key compromise has a multiplier effect: the same technique can be replayed against every vulnerable deployment, enabling broad, low-cost compromise. Because no exploit code is public, in-the-wild exploitation is not yet evidenced, but the low attack complexity and lack of required privileges make weaponization straightforward once the key is known.

Impact Assessment

The business impact is severe for any organization running Brocade ASCG below 3.5.0 with the SupportLink API exposed. The authentication bypass allows an unauthenticated remote actor to act as a trusted client of the API, undermining the core trust boundary of the product.

• Confidentiality (C:H): Bypassing authentication exposes any data or functionality the SupportLink API mediates.
• Integrity (I:H): The attacker can issue authenticated actions, including those that alter state.
• Availability (A:H): Full-scope estimates include the ability to disrupt or disable service through authorized-API abuse.
• Scope / blast radius: The "across deployments" property of the hard coded key means the finding is not a single-tenant issue — every affected version shares the weakness, so the effective blast radius is the entire vulnerable population, not one installation.

Because CVSS is N/A in the source data, no vendor severity rating can be cited; the estimated vector above is provided for triage only. EPSS 0.00172 (~6.1st percentile) and absence from CISA KEV indicate exploitation has not been observed in the wild to date, but this reflects current signal, not inherent risk. A low EPSS score should not be used to deprioritize a remotely exploitable authentication bypass with full CIA impact and a fleet-wide (cross-deployment) failure mode.

Detection Guidance

Detection is challenging because forged authentication material may look valid to the API by design. The rules below are necessarily generic — none of the specific endpoints, parameters, or key values are available in the source data — and should be tuned to observed SupportLink API traffic in each environment.

Sigma Rule

title: Suspicious SupportLink API Authentication Activity (CVE-2026-87424)
id: 8f3a1c2e-7b64-4d1a-9c0e-brocade87424
status: experimental
description: Detects anomalous authentication against the Brocade ASCG SupportLink API potentially associated with hard-coded key authentication bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87424
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: brocade
detection:
  selection_api:
    cs-uri-stem|contains:
      - '/SupportLink'
      - '/supportlink'
  selection_auth:
    sc-status: 200
    cs-method: 'POST'
  selection_anomaly:
    cs(User-Agent)|contains:
      - 'python'
      - 'curl'
      - 'Go-http-client'
  condition: selection_api and selection_auth and selection_anomaly
falsepositives:
  - Legitimate automation and monitoring accounts
  - Internal integrations using scripted clients
level: high

YARA Rule

rule CVE_2026_87424_Brocade_ASCG_Hardcoded_Key
{
    meta:
        description = "Detects potential hard-coded cryptographic key artifacts in Brocade ASCG SupportLink API components (CVE-2026-87424)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87424"
        date = "2026-01-01"
        cve = "CVE-2026-87424"
    strings:
        $cwe = "CWE-321"
        $sup1 = "SupportLink" ascii nocase
        $sup2 = "supportlink" ascii
        $auth = "authentication" ascii nocase
        $hard = "hardcoded" ascii nocase
        $hard2 = "hard-coded" ascii nocase
        $key1 = "secret" ascii nocase
        $key2 = "API_KEY" ascii nocase
    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F) and
        filesize < 50MB and
        ($sup1 or $sup2) and
        2 of ($auth, $hard, $hard2, $key1, $key2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87424 Possible Brocade ASCG SupportLink API Auth Bypass Attempt"; flow:established,to_server; http.uri; content:"SupportLink"; nocase; http.method; content:"POST"; http.user_agent; content:"python"; nocase; sid:8742401; rev:1; reference:cve,2026-87424; classtype:attempted-admin; metadata:created_at 2026_01_01, updated_at 2026_01_01;)
alert http any any -> any any (msg:"CVE-2026-87424 Brocade ASCG SupportLink API Access"; flow:established,to_server; http.uri; content:"supportlink"; nocase; threshold:type limit, track by_src, count 20, seconds 60; sid:8742402; rev:1; reference:cve,2026-87424; classtype:misc-activity;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where network.protocol == "http" and http.request.method == "POST"
      and url.path : "*SupportLink*" ]
  [ network where network.protocol == "http" and http.response.status_code == 200
      and url.path : "*SupportLink*" ]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=*brocade*
| eval uri_lower = lower(uri)
| where like(uri_lower, "%supportlink%")
| eval ua_lower = lower(useragent)
| eval suspicious_ua = if(like(ua_lower,"%python%") OR like(ua_lower,"%curl%") OR like(ua_lower,"%go-http-client%"), 1, 0)
| where status=200 AND suspicious_ua=1
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip clientip
| where count > 5
| sort - count
| `comment("CVE-2026-87424 - Potential Brocade ASCG SupportLink API authentication bypass activity")`

Wazuh OSSEC Rule

<group name="brocade,web,cve-2026-87424,">
  <rule id="874240" level="12">
    <if_sid>31100</if_sid>
    <id>^200$</id>
    <url>SupportLink|supportlink</url>
    <description>CVE-2026-87424: Possible Brocade ASCG SupportLink API authentication bypass (HTTP 200 to SupportLink API)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_87424,authentication_bypass,</group>
  </rule>
  <rule id="874241" level="10">
    <if_sid>31100</if_sid>
    <url>SupportLink|supportlink</url>
    <useragent>python|curl|Go-http-client</useragent>
    <description>CVE-2026-87424: Scripted client accessing Brocade SupportLink API - investigate for auth bypass</description>
    <group>cve_2026_87424,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or patch reference was supplied in the source intelligence.

1. Immediate mitigations

   • Restrict network access to the SupportLink API to trusted management networks only; do not expose it to the internet (addresses AV:N exposure).
   • Place the API behind an authenticating reverse proxy or mTLS gateway that enforces its own credentials, so an attacker with the static key still cannot reach the vulnerable component unauthenticated.
   • Monitor and alert on the detection rules above; isolate and investigate any unexpected successful POSTs to the SupportLink API.
   • Inventory all Brocade ASCG deployments and record current versions to size the exposure.

2. Patch / upgrade steps

   • Upgrade Brocade ASCG to 3.5.0 or later, which is the earliest version stated as non-vulnerable in the NVD description.
   • Confirm with the vendor whether 3.5.0 fully replaces the hard coded key with per-deployment key generation or rotation, and whether existing deployments require key rotation or reconfiguration after upgrade.
   • Because the key is shared across deployments, treat any environment that ran a pre-3.5.0 build as potentially compromised; rotate or replace any credentials, tokens, or trust anchors that relied on the SupportLink API authentication.

3. Long-term hardening

   • Eliminate hard coded cryptographic keys from shipped artifacts and enforce per-installation key generation during provisioning (CWE-321 remediation).
   • Implement secret management with rotation for all API authentication keys.
   • Adopt secure design review and static analysis (SAST/secret scanning) to catch embedded keys before release.
   • Enforce least privilege and network segmentation for any support/management API.

References

• NVD — CVE-2026-87424: https://nvd.nist.gov/vuln/detail/CVE-2026-87424 (primary record; source of the NVD description used here)
• CWE-321 — Use of Hard-coded Cryptographic Key: https://cwe.mitre.org/data/definitions/321.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-87424 not listed as of this report)
• Brocade (Broadcom) security advisories portal — consult for any vendor-issued advisory affecting Brocade ASCG SupportLink API authentication (no vendor advisory ID was provided in the source data)

No threat actor campaigns, exploit-in-the-wild evidence, public PoC, or Nuclei template are currently associated with CVE-2026-87424 in the provided intelligence.